This is because a risk program is a strategic initiative that requires the support and involvement of the top leaders of the enterprise. Senior management can demonstrate their commitment to the risk program by:
* Providing clear direction and guidance on the objectives, scope, and approach of the risk program
* Allocating sufficient resources, budget, and authority to the risk program team
* Communicating the importance and benefits of the risk program to all stakeholders
* Encouraging a culture of risk awareness and accountability across the enterprise
* Reviewing and approving the risk program deliverables and outcomes
* Rewarding and recognizing the achievements and contributions of the risk program team and participants A risk management framework (A) is a tool that helps to define and implement the risk program, but it does not ensure its success without senior management commitment. Mandatory risk awareness courses for staff (B) are a way to increase the knowledge and skills of the staff regarding risk management, but they do not guarantee their engagement and participation in the risk program without senior management endorsement. A risk recognition and reporting policy is a document that establishes the rules and procedures for identifying and communicating risks, but it does not ensure its compliance and effectiveness without senior management oversight.

A change in business strategy may require a change in IT governance structure to align with the new direction and objectives of the organization. The other options are not the primary impact of a business strategy change, but rather the outcomes or consequences of IT governance. References := ISACA, CGEIT Review Manual, 27th Edition, 2020, page 10.

A data steward is a role that is responsible for data normalization when it is found that a new system includes duplicates of data items, because a data steward is accountable for the quality, integrity, and consistency of the data in the enterprise. A data steward can define and enforce data standards, policies, and rules, and perform data cleansing, validation, and reconciliation activities to ensure that the data is accurate, complete, and reliable12.